summaryrefslogtreecommitdiff
path: root/drivers/usb/class
diff options
context:
space:
mode:
authorOliver Neukum <oneukum@suse.com>2016-03-15 10:14:04 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2016-03-18 09:19:02 -0700
commit8835ba4a39cf53f705417b3b3a94eb067673f2c9 (patch)
tree87218c976ba7901876cf9ad328823d31ad028fad /drivers/usb/class
parent0b818e3956fc1ad976bee791eadcbb3b5fec5bfd (diff)
USB: cdc-acm: more sanity checking
An attack has become available which pretends to be a quirky device circumventing normal sanity checks and crashes the kernel by an insufficient number of interfaces. This patch adds a check to the code path for quirky devices. Signed-off-by: Oliver Neukum <ONeukum@suse.com> CC: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/class')
-rw-r--r--drivers/usb/class/cdc-acm.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 1d2c99af2532..83fd30b0577c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1179,6 +1179,9 @@ static int acm_probe(struct usb_interface *intf,
if (quirks == NO_UNION_NORMAL) {
data_interface = usb_ifnum_to_if(usb_dev, 1);
control_interface = usb_ifnum_to_if(usb_dev, 0);
+ /* we would crash */
+ if (!data_interface || !control_interface)
+ return -ENODEV;
goto skip_normal_probe;
}